What to fix now, and how a production Security Agent stays on the job

19 October 2026 · Sources: CISA, 16 October, CISA, 14 October, OWASP Top 10:2025

A production Security Agent is the working practice for these risks: it checks the live exposure, the access rules and the dependencies, proposes the fix, and stays on the product after the first review so the next release does not start from zero.

What is being exploited right now?

CISA's Known Exploited Vulnerabilities catalog is the short list of flaws already used in attacks. On 16 October 2026 CISA added a Fortinet path traversal affecting multiple products (CVE-2025-61624) and a BeyondTrust Remote Support authentication bypass (CVE-2026-102764). On 14 October 2026 it added a Palo Alto Networks PAN-OS code injection (CVE-2026-0322), a Cisco Secure Email Gateway path traversal (CVE-2026-76519), and two AhsayCBS flaws, an authentication failure (CVE-2026-105133) and a command injection (CVE-2026-105134).

If you run any of those products on a network you can reach from the internet, patch or otherwise mitigate them before you start a broader redesign. CISA's note on both alerts is the same: these classes of bug are a frequent path in, and federal agencies are expected to treat catalog entries on exposed systems as urgent. Everyone else should use the same order. A scanner finding from last quarter is less urgent than a product you still have exposed that is already on that list.

What does the OWASP Top 10 for 2025 say to fix?

The OWASP Top 10:2025 is the application list, separate from the network appliances above. The order is the work order:

Broken access control is still first. A request that looks well formed can still ask for another tenant's record. The vibe-coding security checklist and the payment security guide cover the cases an edge rule cannot see.

What should a team do this week?

Make a one-page inventory: public routes, the products in front of them, the identity source, and the actions that touch money or customer records. Match that inventory to the current CISA catalog and to the dependencies in the release you are about to ship. Patch the exploited products you actually run. Then test one access-control case a stranger could try: another customer's id, a self-assigned admin role, a webhook with a bad signature.

Write down what you did not test. A clean dashboard is not evidence that the mobile client, the preview deploy and the provider callback were all in the sample.

How does the production Security Agent do the work?

The agent takes that inventory and keeps running it. It reads the routes, the dependency list and the current exploited-vulnerability catalog, and it returns a concrete queue: patch this exposed product, add this ownership check, fail this path closed. It drafts the change against the code and the config you already have. A person approves anything that changes who can sign in, who can pay, or which data leaves the system.

Speed comes from not restarting the review. The first pass builds the map. The next pass only rechecks what changed, plus anything new on the exploited list. That is how security keeps up with a team that ships every week, without pretending a model is the authorization layer. Permissions still execute in the application. The Cloudflare Application Profiles post explains the same split at the edge.

How does it stay involved?

A one-off report goes stale on the next deploy. The Security Agent stays on the engagement. When a route, a dependency or a payment provider changes, the same checks run again and the open items stay visible. Alerts go to a named owner. The agent does not close an item because a vendor email said the issue was informational.

It also stays inside a scope. It does not get standing permission to change production, to read customer payment data into a prompt, or to mark a finding fixed. The agent permissions guide is the pattern: the tool can propose, and the record of who approved the change remains.

If you want that working relationship on a product you already ship, start with the cybersecurity practice or book a 30-minute call. We scope the exposed systems, the access rules and the verification you will be able to show, then the agent stays on that scope.